PT-2017-18590

Name of the Vulnerable Software and Affected Versions Elemental Path's CogniToys Dino smart toys versions 0.0.794 and earlier Description The issue concerns a lack of sufficient protections against capture-replay attacks in the VoIP traffic between the Dino device and a remote server. This allows...

CVE-2017-15940: Improper Neutralization of Special Elements used in a Command

The web interface packet capture management component in Palo Alto Networks PAN-OS before 6.1.19, 7.0.x before 7.0.19, 7.1.x before 7.1.14, and 8.0.x before 8.0.6 allows remote authenticated users to execute arbitrary code via unspecified vectors...

Uber: SSL-protected Reflected XSS in m.uber.com

Summary m.uber.com is susceptible to reflected XSS Security Impact A malformed URL can be used to render arbitrary SSL-protected web pages from m.uber.com Reproduction Steps https://m.uber.com/?bjbxm%3c%2fscript%3e%3cscript%3ealert1%3c%2fscript%3exrii5=1 Specifics From the rendered web page:...

HOT Man Android App Has Information Leakage Vulnerability

HOT Man Android APP is a mobile magazine software. There is an information leakage vulnerability in HOT Man Android APP. After registering and logging in to the system, an attacker can obtain sensitive information such as other users' UIDs, names, and cell phone numbers by clicking on "My Avatar"...

The Mutiny Fuzzing Framework and Decept Proxy

This blog post is authored by James Spadaro of Cisco ASIG and Lilith Wyatt of Cisco Talos. Imagine a scenario where you, as a vulnerability researcher, are tasked with auditing a network application to identify vulnerabilities. By itself, the task may not seem too daunting until you learn of a...

Palo Alto Networks PAN-OS Remote Command Injection Vulnerability

Palo Alto Networks PAN-OS is an operating system developed by Palo Alto Networks for its firewall devices. web interface packet capture management component is one of the web interface packet capture management components. A remote command injection vulnerability exists in the web interface packe...

PT-2017-14298

Name of the Vulnerable Software and Affected Versions Palo Alto Networks PAN-OS versions prior to 6.1.19 Palo Alto Networks PAN-OS versions 7.0.x prior to 7.0.19 Palo Alto Networks PAN-OS versions 7.1.x prior to 7.1.14 Palo Alto Networks PAN-OS versions 8.0.x prior to 8.0.6 Description The issue...

Out-of-authority access vulnerability in Butler Smart App for Android

The Butler Smart App is a mobile application that goes along with the smart cat eye device. The Android version of Butler Smart APP suffers from an overstepping access vulnerability, which allows an attacker to log in to other users' systems and perform unauthorized operations by grabbing packets...

Wise Heat Temperature Control App for Android has an arbitrary account password reset vulnerability

Smart Heat Temperature Control APP a home temperature control software, users only need to add the home's Internet-accessible thermostat to the software, you can use your phone or tablet to control the temperature of your home's HVAC equipment. The Android version of Smart Heat Temperature Contro...

sAINT - A Spyware Generator for Windows systems written in Java

sAINT is a Spyware Generator for Windows systems written in Java. Features Keylogger Take Screenshot Webcam Capture Persistence Tested On KaliLinux - ROLLING EDITION How To Use Install dependencies you need Maven and JDK 8 package installed $ apt install maven default-jdk default-jre openjdk-8-jd...

Cambium Multiple Vulnerabilities

Vulnerabilities Summary The following advisory describes three 3 vulnerabilities found in Cambium Network Updater Tool and Networks Services Server. The Network Updater Tool is “a free-of-charge tool that applies packages to upgrade the device types that the release notes for the release that you...

Android Flaw Lets Attackers Capture Screen and Record Audio

By Waqas If your Android smartphone has Lolipop, Nougat or Marshmallow, then This is a post from HackRead.com Read the original post: Android Flaw Lets Attackers Capture Screen and Record Audio...

HackerOne: IDOR on Program Visibilty (Revealed / Concealed) against other team members

Hi HackerOne Team, Summary: When you are a part of a program security team, you have a choice to show in your profile that you are a member of the sec team, you can also hide it if you don't want to show it to your profile, any team member can do that using your profile settings here:...

Rimet Wifi Smart Temperature Control Android APP has an override access vulnerability

Rimet Wifi Smart Temperature Control Android APP is a management platform for smart hardware devices. Rimet Wifi Intelligent Temperature Control Android APP has an override access vulnerability. After logging into the client, the attacker can obtain sensitive information such as patient's name,...

This Week in Security News

Welcome to our weekly roundup, where we share what you need to know about the cybersecurity news and events that happened over the past few days. Below you’ll find a quick recap of topics followed by links to news articles and/or our blog posts providing additional insight. Be sure to check back...

Top Smart Android APP has logic design flaws

Top Smart Android APP is a marketing management software for the majority of users. The software can help users keep abreast of information developments and activities in the smart home industry. There is a logic design vulnerability in Top Smart Android APP. Attackers can log in to any account b...

Trend Micro Capture the Flag: Train security professionals – Close the skills gap

Businesses today face a security challenge: Protecting their systems and data is vital, but there aren’t enough qualified employees who can successfully make that happen. Similarly, young cybersecurity professionals need to overcome the gap between what is learned in a classroom and the practical...

PT-2017-3776

Name of the Vulnerable Software and Affected Versions Moxa IKS and EDS affected versions not specified Description The issue is related to the generation of a predictable cookie using an MD5 hash, which can be exploited by an attacker to capture the administrator's password. This could potentiall...

How to Run Packet Capture on NetScaler SD-WAN WANOP

This article describes how to run packet capture on NetScaler SD-WAN WANOP...

chromium-browser null pointer reference vulnerability

chromium-browser is an open source web browser project started by Google to provide source code for the proprietary Google Chrome browser. A null pointer reference vulnerability exists in the chromium-browser image capture widget. An attacker could exploit the vulnerability to cause a denial of...